{"cve":"CVE-2018-8868","nvd":{"published":"2018-07-03T01:29:01.877","modified":"2026-06-17T02:05:33.167","status":"Modified","description":"Medtronic 24950 MyCareLink Monitor and 24952 MyCareLink Monitor contains debug code meant to test the functionality of the monitor's communication interfaces, including the interface between the monitor and implantable cardiac device. An attacker with physical access to the device can exploit other vulnerabilities to access this debug functionality. This debug functionality provides the ability to read and write arbitrary memory values to implantable cardiac devices via inductive or short range wireless protocols. An attacker with close physical proximity to a target implantable cardiac device can use this debug functionality.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:P/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L","score":6.2},"cwes":["CWE-749"],"references":["https://global.medtronic.com/xg-en/product-security/security-bulletins/mycarelink-6-28-18.html","https://ics-cert.us-cert.gov/advisories/ICSMA-18-179-01","https://ics-cert.us-cert.gov/advisories/ICSMA-18-179-01"],"products":["medtronic:24950_mycarelink_monitor_firmware","medtronic:24952_mycarelink_monitor_firmware"],"source":"nvd","synced_at":"2026-10-19T20:51:47.459859389+00:00"},"epss":{"cve":"CVE-2018-8868","score":0.00333,"percentile":0.26707,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}